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May 2002 


I have the honour to submit to you my Report to Parliament Concerning Substantially 


Similar Provincial Legislation. 


Under the Personal Information Protection and Electronic Documents (PIPED) Act, 1 am 


required to report annually to the Parliament of Canada on the extent to which the provinces 


have enacted legislation that is “substantially similar” to the PIPED Act. 


Although I touched on this issue in my 2000-2001 Annual Report to Parliament, this 


is my full report on the matter to date. 


Yours sincerely, 


George Radwanski 


Privacy Commissioner of Canada 
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REPORT TO PARLIAMENT 


CONCERNING SUBSTANTIALLY SIMILAR 
PROVINCIAL LEGISLATION 


INTRODUCTION 


Subsection 25(1) of the Personal Information 
Protection and Electronic Documents (PIPED) 
Act requires me to report annually to the 
Parliament of Canada on the “extent to which 


the provinces have enacted legislation that is 
“substantially similar” to the PIPED Act. 


In my 2000-2001 Annual Report to Parliament, 
which I tabled on December 12, 2001, I 
touched briefly on how I propose to interpret 
“substantially similar” and provincial legisla- 
tive initiatives to regulate the private sector. 

I am now reporting more fully on the matter 


of substantially similar provincial legislation. 


As I discuss below, every province has sectoral 
laws that contain provisions providing limited 
protection of personal information and some 
provinces have passed more detailed legisla- 
tion dealing with personal health information. 
These sector-specific laws provide important 


but fragmentary protection. 


A few provinces have taken preliminary steps 
towards introducing comprehensive legislation 
to control the collection, use and disclosure 


of personal information in the private sector. 


Other provinces may be considering similar 
legislation. Such legislation would subsume 
some of these sector-specific laws. Until it 
becomes clearer which provinces will pass 
such legislation, I will refrain from comment- 


ing on this sector specific legislation. 


However, | will take this opportunity to 
provide my assessment of Quebec’s 
comprehensive private sector legislation, 
the Act Respecting the Protection of Personal 


Information in the Private Sector. 


BACKGROUND 


Paragraph 26(2)(b) of the P/PED Act gives the 


Governor in Council the power to: 


“if satisfied that legislation of a province 
that is substantially similar to this Part 
applies to an organization, a class of organ- 
izations, an activity or a class of activities, 
exempt the organization, activity or class 
from the application of this Part in respect 
of the collection, use or disclosure of 
personal information that occurs within 


that province.” 
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The intent of this provision is to allow 
provinces and territories to regulate the per- 
sonal information management practices of 


organizations operating within their borders. 


Once the Governor in Council has issued an 
Order declaring legislation to be substantially 
similar, only personal information that flows 
across provincial or national borders will be 
subject to the PIPED Act. The PIPED Act will 
continue to apply within a province to the 
activities of organizations that are under fed- 
eral jurisdiction such as banking, broadcast- 


ing, telecommunications and transportation. 


The PIPED Act does not provide any explicit 
guidance in terms of the criteria to be used 
in determining whether or not legislation 
enacted by a province is substantially similar. 
Nor does the Act provide any guidance in 
terms of the process that would trigger a 


determination of substantially similar. 


My DETERMINATION OF 
“SUBSTANTIALLY SIMILAR” 


In assessing provincial legislation, I will 
interpret substantially similar to mean equal 
or superior to the PIPED Act in the degree 
and quality of privacy protection provided. 
The federal law is the threshold or floor. A 
provincial privacy law must be at least as 


good, or it is not substantially similar. 


To be considered substantially similar, any 
provincial legislation will have to contain, at 
a minimum, the ten principles set forth in 
Schedule 1 to the PIPED Act. While I con- 
sider all ten principles of this code to be inter- 
related and equally important, I consider 
consent and access and correction rights, 
along with the reasonable person test to be 
the key components in making an assessment 
of substantially similar. In addition, any 
provincial law would need to provide for 


effective oversight and redress. 


Consent 

The federal law says that consent must be 
informed and that an organization may only 
collect, use or disclose personal information 
about an individual with the individual’s 
consent except in certain limited circum- 


stances that are set out in the Act. 


After collection, personal information can 
only be used or disclosed for the purpose for 
which consent was given, except in certain 


circumstances that are set out in the Act. 


Reasonable Person Test 

The reasonable person test provides another 
important check on organizations. The law 
states that the collection, use, and disclosure 
of personal information must be limited to 
purposes that a reasonable person would 


consider appropriate in the circumstances. 
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This test prevents organizations from using 
overly broad or vague statements of the pur- 
poses for which information is being collected 


and from coercing individuals to give consent. 


Access and Correction Rights 

Individuals must have the right to access 
personal information that organizations have 
about them and to correct any information 
that is incorrect (or to have any disagreement 
noted and provided to any party who received 


the information). 


Oversight 

Where an individual is of the opinion that his 
or her privacy rights have been violated or that 
the privacy law has not been respected, the 
individual must have the ability to complain 
to a fully independent oversight body with 
the specific mandate to resolve complaints, 
thoroughly investigate, mediate, conciliate 
and make recommendations or issue orders. 
Such an oversight body also must have the full 
range of investigative powers to seize docu- 
ments, enter premises, compel testimony and 


initiate audits of an organization's practices. 


Redress 

Following a complaint, and the issuance of 
my report, the federal Act allows the com- 
plainant (or myself directly) to apply for a 
hearing in the Federal Court of Canada. The 
complainant or I can ask the court to order 
the organization in question to correct its 
information handling practices and make 
public the steps it has taken to do so. The 
court can be asked to award damages to 


the complainant. 


Decisions of the Federal Court can be 
appealed to the Federal Court of Appeal and 


with leave to the Supreme Court of Canada. 


There must be corresponding redress 
provisions in any provincial legislation which 


purports to be “substantially similar”. 


INDUSTRY CANADA'S 
PROCESS FOR ASSESSING 
SUBSTANTIALLY SIMILAR 


Following discussions with my office, the 
Department of Industry published a notice in 
the Canada Gazette Part t (September 22, 
2001) setting out the process that the depart- 
ment will follow for determining whether 
provincial/territorial legislation will be 


deemed substantially similar. 


The process will be triggered by a province, 
territory or organization advising the Minister 
of Industry of legislation that they believe is 
substantially similar to the PIPED Act. The 
Minister may also act on his or her own initia- 
tive and recommend to the Governor in 
Council that provincial or territorial legisla- 


tion be designated as substantially similar. 


The Minister will seek the Privacy 
Commissioner's views on whether or not 
legislation is substantially similar and include 
the Commissioner's views in the submission 


to the Governor in Council. 
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The process also provides for an opportunity 
for the public and interested parties to com- 


ment on the legislation in question. 


According to the Canada Gazette notice, 
the Minister will expect substantially similar 


provincial or territorial legislation to: 


m incorporate the ten principles in Schedule 1 


of the PIPED Act, 


m provide for an independent and effective 
oversight and redress mechanism with 


powers to investigate; and 


m restrict the collection, use and disclosure of 
personal information to purposes that are 


appropriate or legitimate. 


PROVINCIAL PUBLIC 
SECTOR LEGISLATION 


New Brunswick’s Protection of Personal 
Information Act came into force in April 2001. 
Prince Edward Island’s Freedom of Information 
and Protection of Privacy Act received Royal 
Assent on May 15, 2001, and will come into 
force in November 2002. With the introduc- 
tion and passage of these two Acts, every 
province and territory in Canada with the 
exception of Newfoundland and Labrador 
now has statutory protection for personal 
information held by government departments 


and agencies. 


PROVINCIAL PRIVATE 
SECTOR LEGISLATION 


To date, Quebec is the only province in 
Canada with comprehensive legislation that 
applies to personal information in the private 
sector. The Act Respecting the Protection of 
Personal Information in the Private Sector came 
into effect, with a few exceptions, on January 1, 
1994. The legislation sets out detailed 
provisions that enlarge upon and give effect 

to the information privacy rights in Articles 


35 to 41 of the Civil Code of Quebec. 


Four other provincial governments — New 

Brunswick, British Columbia, Manitoba and 
Ontario — have explored legislative options for 
the comprehensive regulation of the collection, 
use, and disclosure of personal information in 


the private sector. 


New Brunswick’s Department of Justice 
issued Privacy Discussion Paper # 2 in May 
1998. One of the purposes of the paper was to 
ask “whether data protection legislation is also 
needed in the private sector and, if so, what it 
should say.” The first discussion paper dealt 


with public sector legislation. 
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The Manitoba Ministry of Consumer and 
Corporate Affairs released a discussion paper, 
The Protection of Personal Information in 

the Private Sector, in March 1999. This was 
followed up by a series of public meetings 


in communities throughout Manitoba. 


The government of British Columbia released 
a discussion paper in October 1999, Protecting 
Personal Privacy in the Private Sector. A Special 
Committee on Information Privacy in the 
Private Sector held public hearings on the 


discussion paper in January 2000. 


These discussion papers were issued by goy- 
ernments that have since been voted out of 
office. However, in February 2002, the new 
British Columbia Minister of Management 
Services did state that the government intends 
to introduce legislation to protect personal 


information held by the private sector. 


The Government of Ontario released a dis- 
cussion paper in July 2000 on a proposed 
Ontario privacy act. This was followed by 
draft legislation that was issued for comments 
on February 4, 2002. The new legislation is 
called the Privacy of Personal Information 


Act, 2002. 


The document released by the Ontario 
Ministry of Consumer and Business Services 
is both draft legislation and a consultation 


paper. Individuals and organizations were 


invited to comment on the legislation until 
March 31, 2002. There are 19 sets of questions 
throughout the document to help individuals 


and organizations frame their comments. 


The proposed legislation will apply to the 
private sector, the health sector, and organiza- 
tions such as charities, professional associa- 
tions, religious groups and universities. The 
legislation will not apply to personal informa- 
tion collected, used or disclosed for personal 
non-commercial purposes or to personal 
information an organization collects, uses or 
discloses for artistic, journalistic or literary 
purposes. Similarly, the PYPED Act does not 
apply to personal information collected, used 


or disclosed for these purposes. 


PROVINCIAL SECTOR SPECIFIC 
LEGISLATION 


Many provincial sector specific laws include 
provisions dealing with the protection of 
personal information. Every province except 
New Brunswick has legislation dealing with 
consumer credit reporting. These Acts typi- 
cally impose an obligation on credit reporting 
agencies to ensure the accuracy of the infor- 
mation, place limits on the disclosure of the 
information and give consumers the right to 
have access to, and challenge the accuracy of, 


the information. 
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Many Acts impose obligations limiting the 
disclosure of information. Several provinces 
have passed legislation that imposes restric- 
tions on the disclosure of personal informa- 
tion by private investigators. Laws governing 
credit unions typically have provisions dealing 
with the confidentiality of information relat- 
ing to members’ transactions. There are a 
large number of provincial Aczs that contain 
confidentiality provisions concerning personal 


information collected by professionals. 


The Health Sector 

The provinces of Alberta, Manitoba and 
Saskatchewan have all passed health-specific 
privacy legislation. The legislation in 
Manitoba and Alberta is currently in force. 
Saskatchewan has not announced when its 


legislation will come into force. 


All three laws establish rules for the collection, 
use and disclosure of personal health informa- 
tion. They each set out rights of access and 
correction as well as the right to request a 
review by an oversight body, who can investi- 


gate complaints. 


These laws apply to personal health informa- 
tion held by provincial government ministries, 
hospitals, regulated health professions (such as 
physicians, pharmacists, dentists, registered 
nurses), laboratories and other health care 


facilities. 


Quebec’s Act Respecting the Protection 

of Personal Information in the Private Sector 
covers health information in the private sector. 
It applies to all enterprises in Quebec, includ- 
ing private sector organizations that deliver 
health services, as well as any professional who 
operates a practice. Quebec's Act Respecting 
Access to Documents Held by Public Bodies and 
the Protection of Personal Information applies 


to the remainder of the health sector. 


British Columbia does not have specific 
health sector legislation, but its public sector 
legislation, the Freedom of Information and 
Protection of Privacy Act, covers health infor- 
mation held by all publicly funded health 
organizations and health care providers, 


including clinics, universities and hospitals. 


In 1995 the scope of the Act was expanded to 
include all self-governing professional bodies. 
These bodies include the College of 
Physicians and Surgeons, the College of 
Dental Surgeons, the College of Pharmacists, 
Registered Nurses Association and the Health 
Professions Council. Practitioners in private 
practice and private clinics and laboratories 


fall outside the scope of the Act. 


In December 2000, Ontario introduced Bill 
159, the Personal Health Information Privacy 
Act. This bill died on the order paper when 
the provincial legislature prorogued on 


March 2, 2001. 
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Ontario has now decided to include health 
specific provisions in its general private 
sector legislation, the Privacy of Personal 
Information Act, 2002. The draft Ontario 
legislation will apply to all health care 
providers except aboriginal and spiritual 
healers, and midwives working within their 


own communities. 


The PIPED Act will not apply to the 
intraprovincial collection, use or disclosure 
of personal information in the course of 
commercial activities by organizations subject 
to provincial law until January 1, 2004. 

As January 1, 2004 approaches, the intentions 


of the provinces may become clearer. 


Against this background, I will now turn to 
commenting on the only comprehensive 
provincial private sector legislation currently 
in effect, Quebec’s Act Respecting the 
Protection of Personal Information in the 


Private Sector. 
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Quesec’s Act RESPECTING THE PROTECTION OF PERSONAL INFORMATION IN THE PrivaTE SECTOR 


QueBEc’s Act RESPECTING 
THE PROTECTION OF 
PERSONAL INFORMATION IN 
THE PRIVATE SECTOR 


Quebec's Act Respecting the Protection of 
Personal Information in the Private Sector is 
structured very differently from the P/PED 
Act. Nonetheless, the overall thrust and the 
general intent of the two Acts are similar. 
Both Acts are based on the Organization for 
Economic Co-operation and Development 
Guidelines on the Protection of Privacy and 


Transborder Flows of Personal Information. 


The two Acts are generally similar in terms 
of scope and application: the definitions of 
personal information are similar; both apply 
to employee information; and both have a 
journalistic exception, although the P/PED 
Act exception includes artistic or literary 
purposes. The most significant difference 
in terms of application is that the Quebec 
legislation also applies to non-commercial 
organizations. (The Quebec legislation uses 
the term “enterprises” and persons. I have 
used the term organizations for the sake 


of consistency.) 


Legislation has been introduced to amend the 
Quebec Act. The most significant proposed 


amendments include: 


w Personal information held by professional 


bodies will be covered; 


m An organization must take special measures 
to help individuals with disabilities gain 


access to their information; 


m An organization may charge for special 


measures taken to provide access; 


= Consent is not required for disclosures for 


archival purposes; 


= Consent is not required for disclosure of 
information that is over 100 years old or 
relates to an individual who has been dead 


for over 30 years; 


a No health information can be disclosed 
without consent in a way that identifies an 
individual unless the information is over 


100 years old; 


m Consent is not required for the disclosure 
of personal information considered by law 


to be public; and 


= An organization's obligation to ensure com- 
pliance with the Quebec legislation when 
disclosing information outside Quebec 
extends to any information not just that of 


Quebec residents. 
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On balance, the proposed amendments, if 
passed, will strengthen the legislation with the 
exception of new disclosures without consent. 
However, these disclosures are generally 


consistent with the PIPED Act. 


In addition to the Quebec legislation and 
the provincial public sector legislation, the 
Quebec Civil Code and the Quebec Charter 
of Human Rights and Freedoms provide 
important privacy rights. The Civil Code was 
completely updated in 1993. Articles 35 to 41 
of the Code deal specifically with privacy 
protection. Articles 35 and 36 address 
territorial privacy, for example stalking, and a 
general privacy tort. Articles 37 to 41 contain 
broad data protection principles such as 
limiting collection, requirements for consent, 


and access and correction rights. 


ASSESSMENT OF 
SUBSTANTIALLY SIMILAR 


In assessing the legislation, I have looked 

for the ten principles set forth in Schedule 1 
to the PIPED Act. | have placed particular 
emphasis on five components of the PJPED 
Act. consent, the reasonable person test, access 


and correction rights, oversight, and redress. 


The Ten Principles 

All of the ten principles are readily apparent 
in the Quebec legislation except for the 
accountability principle and the openness 


principle. 


Io 


The accountability principle states: 


“An organization is responsible for personal 
information under its control and shall 
designate an individual or individuals 

who are accountable for the organization's 


compliance with the following principles.” 
The openness principle states: 


“An organization shall make readily avail- 
able to individuals specific information 
about its policies and practices relating to 


the management of personal information.” 


There is no provision in the Quebec legisla- 
tion that specifically requires an organization 
to designate an accountable individual. 
However, the legislation does establish a 
clear accountability process. Organizations 
can only collect information for a serious 
and legitimate purpose; they are required 

to protect the information; and they can 

be held accountable if they fail to abide by 


the requirements in the legislation. 


There is no specific requirement in the 
Quebec legislation that organizations be 
“open about their policies and practices”. 
There are two sections in the Quebec legisla- 
tion that address openness indirectly. Section 
79 requires “personal information agents” — 
credit reporting agencies — to make their 
activities known to the public by means of 
notices published periodically in the press. 
Section 8 requires an organization, when 


collecting information from an individual, 


, 
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to inform the individual of the object of the 
file, the use that will be made of the informa- 
tion, the categories of person within the 
organization who will have access to the infor- 
mation, the place where the file will be kept, 


and his or her access and correction rights. 


Consent 
The PIPED Act requires: 


“The knowledge and consent of the indi- 
vidual are required for the collection, use, 
or disclosure of personal information, 


except where inappropriate.” (Principle 4.3) 


“Consent is required for the collection of 
personal information and the subsequent 
use or disclosure of this information.” 


(Principle 4.3.1) 
The Quebec legislation states: 


“Any person collecting personal informa- 
tion relating to another person may collect 
such information only from the person 
concerned, unless the latter consents to 


collection from third persons.” (section 6) 


“Consent to the communication or use 
of personal information must be manifest, 
free and enlightened, and must be given 
for specific purposes. Such consent is 
valid only for the length of time needed 
to achieve the purposes for which it 


was requested. 


Consent given otherwise than in accor- 
dance with the first paragraph is without 


effect.” (section 14) 


Section 14 of the Quebec legislation does not 
mention collection, suggesting that consent is 
not required for collection. However, section 6 
requires that information must be collected 
from the person concerned unless the latter 
consents to collection from third parties, 

thus effectively providing for consent. (If the 
information is being provided by the person 
concerned, consent is implied.) As well, an 
amendment has been proposed that would 
add the term collection to section 14. If 
passed, this amendment would bring a highly 


welcome element of additional clarity. 


The term “manifest” in section 14 of the 
Quebec legislation means clear, and unequiv- 
ocal and precise. The term enlightened is 
generally equivalent to the requirement in the 
PIPED Act that consent must be accompanied 
by knowledge of the purpose(s) for which the 
information is to be used (Principle 4.3.2). 
The Quebec legislation requires that consent 
be free: the PIPED Act (Principle 4.4.2) states 
that consent for collection must not be 
obtained through deception while Principle 
4.3.3 states that an organization cannot 
require someone to consent to collection, 

use or disclosure beyond that required for 


explicitly specified purposes. 


On balance, the general consent require- 
ment in the Quebec legislation is at least as 
strong as in the PIPED Act. 


Both the PIPED Act and Quebec’s Act have 
exceptions allowing collection, use or disclo- 


sure without consent. 


Il 
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The Quebec legislation provides that an 
organization may only collect personal infor- 
mation from a third party without consent if 
the law so authorizes, or if the personal infor- 
mation is being collected for a serious and 
legitimate reason. In the latter case, one of the 
following conditions must apply: the informa- 
tion cannot be collected from the individual 
concerned “in due time” or collection from a 


third party is necessary to ensure accuracy. 


Unlike the PIPED Act, the Quebec legislation 
does not contain any clearly defined 
circumstances where information can be 

used without consent. However, some of the 
disclosures without consent discussed below, 
such as the nominative lists, information 
disclosed for research purposes or for the 
purpose of recovering a debt, also involve a 


use without consent. 


With respect to disclosure without consent, 
the PIPED Act lists 14 circumstances, the 
Quebec legislation slightly fewer. One 
noteworthy difference is the nominative 

list exception in the Quebec legislation. 

A nominative list is simply a marketing list — 
names, addresses and telephone numbers. 
The Quebec legislation allows an organization 
to communicate a nominative list to a third 
party without consent, provided a contract 
prevents the information from being used for 
any purpose other than “commercial or phil- 
anthropic prospection’, the people on the list 
have a chance to opt out, and the communi- 


cation does not “infringe upon the privacy of 


I2 


the persons concerned”. This last qualification 
is presumably meant to address situations in 
which the source of the list, for example a 
magazine, might potentially reveal sensitive 


information such as a medical condition. 


In some cases, when information is disclosed 
without consent, for example for research 
purposes or for the recovery of debts, the 
Quebec legislation requires that these disclo- 
sures be entered in the individual’s file. Under 
the PIPED Act, an organization has to inform 
the Commissioner before information is 
disclosed, without consent, for statistical, 
scholarly or research purposes. More generally, 
Principle 4.9.1 requires an organization to 
provide, upon request, an account of third 
parties to which personal information has 


been disclosed. 


Both pieces of legislation have relatively 
broad exemptions allowing disclosure without 


consent for law enforcement purposes. 


On the whole, the situations when consent 
is not required for collection, use or disclo- 


sure are roughly similar in the two Acts. 


Access and Correction Rights 

The Quebec legislation has a strong right of 
access. In response to a written request, an 
organization must “confirm the existence of 
the file and communicate to the person any 


personal information concerning him”. 


An organization must reply to a written access 
or rectification request within 30 days and 


there is currently no right of extension. 


, 
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(The PIPED Act allows for an extension on 
limited grounds provided the individual is 
informed.) No fee can be charged for access to 
the information, but a reasonable charge can 
be required for reproduction or transmission 


of the information. 


Certain exceptions to access apply. The widest 
general exception is set out in Article 39 of the 
Civil Code that allows access to be denied 
when there is a “serious and legitimate reason 
for doing so’. The other access exceptions in 
the Quebec legislation are similar to those in 
the PIPED Act. The Quebec legislation does 
not contain a “confidential commercial infor- 


mation’ exception as is found in the PIPED Act. 


The Commission’s public order remedy for 
access is quick, can be held in the applicant's 
county of residence and is only used if the 


Commissioner cannot mediate the dispute. 


On balance, the access and correction rights 
under the Quebec legislation are at least as 


strong as under the PIPED Act. 


With respect to correction, where there is a 
disagreement relating to a request for correc- 
tion, the organization holding the file must 
prove that the file need not be rectified. Under 
the PIPED Act, the burden of proof lies with 
the individual. 


Oversight 

La Commission d acces a l'information 

(the Commission) is vested with the 
oversight authority to monitor the operation 


of the legislation. 


IN THE Private SECTOR 


The Commission has the authority to: 

m receive complaints; 

& initiate investigations; 

® compel the production of information; 
m enter premises; 


@ examine and make copies of 


relevant information; 
= determine its own investigative procedures; 
mw mediate disputes; 


® refuse to examine a matter it considers 


frivolous or made in bad faith; 


™ recommend remedial measures that are 
appropriate to ensure the protection of the 


personal information; 
m order remedial measures; 


m fix time limits for the implementation of 


these measures; 


u disclose information about an organiza- 


tion’s non-compliance; and 
m issue final decisions on matters of fact. 


The Commission is required to render a deci- 
sion in writing concerning every disagreement 


submitted to it. 


The Commission has all the powers of a court 


of law. 


B 
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The Privacy Commissioner’s authority 
under the PIPED Act is similar except that 


the Commissioner cannot issue orders. 


The Quebec legislation gives the 
Commission strong oversight powers that 
are at least equal to those of the federal 


Privacy Commissioner under the Act. 


Redress 
As discussed above, the Commission has 
extensive powers. In terms of redress, these 


include the powers: 


m to make any order it considers appropriate 
to protect the rights of the parties and rule 


on any issue of fact or law; 


m to order a person carrying or an enterprise 
to communicate or rectify personal infor- 


mation or refrain from doing so; 


m after an inquiry, to recommend or order 
the application of such remedial measures 
as are appropriate to the protection of 


personal information; and 


m to designate a person to “attempt to bring 


parties to an agreement’. 


Any order of the Commission is enforceable as 


a court order. 


The Commission’s orders can be appealed to 
the Court of Quebec, with leave, on any ques- 
tion of law or jurisdiction. The decision of the 


Court of Quebec is without appeal. 
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Organizations that collect, hold, communi- 
cate to third persons or use personal informa- 
tion in contravention of the Act are liable to 
fines of $1,000 to $10,000 for an initial 
offence and fines of $10,000 to $20,000 for a 
subsequent offence. In the case of personal 
information agents (organizations that main- 
tain and disclose credit files and reports), the 
fines range from $6,000 to $12,000 for a first 
offence and from $10,000 to $20,000 for a 


subsequent offence. 


Under the PJPED Act there are three offences 


subject to a fine: 


m failing to retain information that is the 


subject of an access request; 


m dismissing or harassing an employee who is 


a whistleblower; and 


# obstructing the Commissioner in the 


course of an investigation or an audit. 


Offenders can be fined up to $10,000 on 
summary conviction or up to $100,000 


on indictment. 


Wronged individuals can seek redress and 
damages under either the Civil Code or 
Quebec’s private sector legislation, except for 
matters relating to access and correction 
rights. The Civil Code specifically transfers 
responsibility on this matter to the legislation. 
Seeking redress under the Civil Code involves 
launching a lawsuit, with all the costs and 


possible rewards this entails. Seeking redress 


, 
Quesec’s Act RESPECTING THE PROTECTION OF PERSONAL INFORMATION 


under the Act is much easier and less costly, 
but not necessarily as effective, far-reaching or 


financially rewarding, assuming one wins. 


The PIPED Act gives the Privacy Commissioner 
considerable latitude in terms of assisti ng 
individuals who have filed a complaint 


and who wish to pursue the matter in the 


Federal Court. 


Comparing the redress provisions in the two 
Acts is difficult because of the role of the 
Civil Code and because the powers and the 
roles of the Commission and the Privacy 
Commissioner differ. Nonetheless, | believe 
that the redress provisions in the Quebec 


legislation are equally effective. 


Reasonable Person Test 
The reasonable person test in the P/PED Act, 


subsection 5(3), states: 


“An organization may collect, use or 
disclose personal information only for 
purposes that a reasonable person 
would consider are appropriate in the 


circumstances.” 


One of the reasons the reasonable person test 
was added during the legislative process was 
to prevent organizations from using overly 
broad or vague purpose statements and then 
collecting information to fulfil these broad 
purposes. The reasonable person test effec- 
tively addresses a weakness in the CSA Code 
(Schedule 1). Even with consent, an organiza- 
tion may only collect, use or disclose personal 


information for purposes that a reasonable 


IN THE PRIVATE SECTOR 


person would consider appropriate in 


the circumstances. 


The Quebec legislation does not have a 
reasonable person test as such, but it does 
state that an organization may only establish 
a file on another person for a serious and 
legitimate reason and that the information 
collected must be necessary for the defined 


object of the file (sections 4 and 5). 


Section 9 states that an organization shall 

not refuse to respond to a request for a good 
or a service or a request relating to employ- 
ment because an applicant refuses to disclose 
personal information, unless the information 
is necessary for performance of a contract or 
the collection is authorized by law. In case 

of doubt, personal information is considered 
to be non-necessary. This last provision shifts 
the burden of proof to justify collection on to 


the organization. 


Although the Quebec legislation does not 
use the term “reasonable person’, I believe 
that the provisions cited above are similar 
in intent and effect in terms of limiting 


unnecessary collection, use or disclosure. 


CONCLUSION 


Based on the foregoing analysis, I believe 
that Quebec’s Act Respecting the Protection 

of Personal Information in the Private Sector 
legislation is substantially similar to the 
PIPED Act in terms of the extent to which it 


protects personal information. 
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